Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
24/02/2024, 18:26
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.eki.co.jp-admin.xxbeo.cn/
Resource
win10v2004-20240221-en
windows10-2004-x64
8 signatures
600 seconds
General
-
Target
https://www.eki.co.jp-admin.xxbeo.cn/
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133532740437428571" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3924 chrome.exe 3924 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe Token: SeShutdownPrivilege 3924 chrome.exe Token: SeCreatePagefilePrivilege 3924 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe 3924 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3924 wrote to memory of 532 3924 chrome.exe 86 PID 3924 wrote to memory of 532 3924 chrome.exe 86 PID 3924 wrote to memory of 2240 3924 chrome.exe 88 PID 3924 wrote to memory of 2240 3924 chrome.exe 88 PID 3924 wrote to memory of 2240 3924 chrome.exe 88 PID 3924 wrote to memory of 2240 3924 chrome.exe 88 PID 3924 wrote to memory of 2240 3924 chrome.exe 88 PID 3924 wrote to memory of 2240 3924 chrome.exe 88 PID 3924 wrote to memory of 2240 3924 chrome.exe 88 PID 3924 wrote to memory of 2240 3924 chrome.exe 88 PID 3924 wrote to memory of 2240 3924 chrome.exe 88 PID 3924 wrote to memory of 2240 3924 chrome.exe 88 PID 3924 wrote to memory of 2240 3924 chrome.exe 88 PID 3924 wrote to memory of 2240 3924 chrome.exe 88 PID 3924 wrote to memory of 2240 3924 chrome.exe 88 PID 3924 wrote to memory of 2240 3924 chrome.exe 88 PID 3924 wrote to memory of 2240 3924 chrome.exe 88 PID 3924 wrote to memory of 2240 3924 chrome.exe 88 PID 3924 wrote to memory of 2240 3924 chrome.exe 88 PID 3924 wrote to memory of 2240 3924 chrome.exe 88 PID 3924 wrote to memory of 2240 3924 chrome.exe 88 PID 3924 wrote to memory of 2240 3924 chrome.exe 88 PID 3924 wrote to memory of 2240 3924 chrome.exe 88 PID 3924 wrote to memory of 2240 3924 chrome.exe 88 PID 3924 wrote to memory of 2240 3924 chrome.exe 88 PID 3924 wrote to memory of 2240 3924 chrome.exe 88 PID 3924 wrote to memory of 2240 3924 chrome.exe 88 PID 3924 wrote to memory of 2240 3924 chrome.exe 88 PID 3924 wrote to memory of 2240 3924 chrome.exe 88 PID 3924 wrote to memory of 2240 3924 chrome.exe 88 PID 3924 wrote to memory of 2240 3924 chrome.exe 88 PID 3924 wrote to memory of 2240 3924 chrome.exe 88 PID 3924 wrote to memory of 2240 3924 chrome.exe 88 PID 3924 wrote to memory of 2240 3924 chrome.exe 88 PID 3924 wrote to memory of 2240 3924 chrome.exe 88 PID 3924 wrote to memory of 2240 3924 chrome.exe 88 PID 3924 wrote to memory of 2240 3924 chrome.exe 88 PID 3924 wrote to memory of 2240 3924 chrome.exe 88 PID 3924 wrote to memory of 2240 3924 chrome.exe 88 PID 3924 wrote to memory of 2240 3924 chrome.exe 88 PID 3924 wrote to memory of 3728 3924 chrome.exe 89 PID 3924 wrote to memory of 3728 3924 chrome.exe 89 PID 3924 wrote to memory of 2764 3924 chrome.exe 90 PID 3924 wrote to memory of 2764 3924 chrome.exe 90 PID 3924 wrote to memory of 2764 3924 chrome.exe 90 PID 3924 wrote to memory of 2764 3924 chrome.exe 90 PID 3924 wrote to memory of 2764 3924 chrome.exe 90 PID 3924 wrote to memory of 2764 3924 chrome.exe 90 PID 3924 wrote to memory of 2764 3924 chrome.exe 90 PID 3924 wrote to memory of 2764 3924 chrome.exe 90 PID 3924 wrote to memory of 2764 3924 chrome.exe 90 PID 3924 wrote to memory of 2764 3924 chrome.exe 90 PID 3924 wrote to memory of 2764 3924 chrome.exe 90 PID 3924 wrote to memory of 2764 3924 chrome.exe 90 PID 3924 wrote to memory of 2764 3924 chrome.exe 90 PID 3924 wrote to memory of 2764 3924 chrome.exe 90 PID 3924 wrote to memory of 2764 3924 chrome.exe 90 PID 3924 wrote to memory of 2764 3924 chrome.exe 90 PID 3924 wrote to memory of 2764 3924 chrome.exe 90 PID 3924 wrote to memory of 2764 3924 chrome.exe 90 PID 3924 wrote to memory of 2764 3924 chrome.exe 90 PID 3924 wrote to memory of 2764 3924 chrome.exe 90 PID 3924 wrote to memory of 2764 3924 chrome.exe 90 PID 3924 wrote to memory of 2764 3924 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.eki.co.jp-admin.xxbeo.cn/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8509f9758,0x7ff8509f9768,0x7ff8509f97782⤵PID:532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1764 --field-trial-handle=1848,i,17268492601562084657,3593266000291178327,131072 /prefetch:22⤵PID:2240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1848,i,17268492601562084657,3593266000291178327,131072 /prefetch:82⤵PID:3728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2224 --field-trial-handle=1848,i,17268492601562084657,3593266000291178327,131072 /prefetch:82⤵PID:2764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3012 --field-trial-handle=1848,i,17268492601562084657,3593266000291178327,131072 /prefetch:12⤵PID:1896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3020 --field-trial-handle=1848,i,17268492601562084657,3593266000291178327,131072 /prefetch:12⤵PID:5048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4820 --field-trial-handle=1848,i,17268492601562084657,3593266000291178327,131072 /prefetch:82⤵PID:2652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5048 --field-trial-handle=1848,i,17268492601562084657,3593266000291178327,131072 /prefetch:82⤵PID:2796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4964 --field-trial-handle=1848,i,17268492601562084657,3593266000291178327,131072 /prefetch:12⤵PID:2448
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2560
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
672B
MD58b87e81f6fec4687f2626bbe47e29519
SHA160cfebd159d2ae0f8cc51f3a14fe6ac6adf8902f
SHA25600fad537b128e558013d28d025e80d58358f24ff52c04390e5ddd1bcbb4e4274
SHA512fefb14d5123e45e20405aa26c69bfe3a6e4aa2961043d92caf96856c5539723450f40f6d9332cb4e29b617d8d2ddc3fafee7bb8d65d05b267be05652c13978c2
-
Filesize
5KB
MD5f9b4c1d3d3eec3b5e8de01e08763a0fd
SHA125174febca8b1245fbf07c66d6bf0b1df5a22e10
SHA256b7a37921edd403fbce6aaed7eb47fa57448f04768d88865d8c6a9c6e02482596
SHA512ec90a56f1d329b7038f12ad621acda206e8b19372c558733dddef7201ff1c6eb5c81940a7d3f8e76e7ed689611110d3eff581d731371d3b2bfa8eefe1d0a12a1
-
Filesize
5KB
MD5f28d5e38245620f05ed810dfdf6917da
SHA15c862cf6ef59b3cd4be9d92b2e067058a9b56a89
SHA2562a29a7ee347f3ff0ce31b48c8bd4970ef6430c971d702b1afa242618c6d34185
SHA512c9083fbdbde502408b387c5e77f8df2f0e51beb412532db5c1a5e8c465721a5a1ac66d5c45e9dd0fc769c0e1b5ce9a5c7a065a0393ef4f8fe0ec728fed0461f4
-
Filesize
5KB
MD542f6d52784d7cbd68196ccd46e48c1e1
SHA135664ec41e740c67e56d9e25538159a05151c76c
SHA25665b51f14dab5cf5841856221ea0b38b328ef348656a0462bfd417844449d252b
SHA512916d20bf25c5f7caec2b5c5c86ced60d6e63637a711f9e1a31a6ed3d7855a5bb098fae489501dd8f561cac9c127b74ccdacd5e1645bc58cb5041528453389271
-
Filesize
130KB
MD53f0d31421c89b2d163ecfeffcbecedcf
SHA1defb1997087084afe11f72c494bc32b08e22f866
SHA2562fada8133c5dc6b7c7004166b046e04b6eaf796fa25ef64e1a03893a3c988897
SHA512148c6148f32b42cedebd2653a7953d885acb7f77ef6310a3f8859581ba971102c66e23d62f2747e10f8cd4fcfcb207fb49011ffc94e586937be320c00c8dacd3
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd